LLM-Assisted Phishing Kits Scale Attacks

A misconfigured server recently provided a rare window into the internal mechanics of a sophisticated malware operation. Security analysts at Rapid7 discovered a repository containing over 1,000 files, including development notes, delivery logs, and experimental phishing templates, revealing that the threat actor was using generative AI to automate the creation and testing of their malicious toolkits.

Mapping the AI-Powered Pipeline

The attackers appeared to treat their operation like a professional software development team, utilizing LLM-assisted workflows to rapidly iterate on phishing techniques. By analyzing the recovered documentation, which included README files, matrix-style testing guides, and a mapping file labeled _MAPPING.csv, researchers linked the project’s structure to the use of generative AI tools. Specifically, the operators relied on Coderrr, an open-source coding agent, to write and iterate on their delivery infrastructure.

The central focus of their efforts was a campaign built around CVE-2025-33053, a WebDAV working-directory hijack that allows attackers to bypass security warnings. While Microsoft issued a patch for the initial implementation of this flaw in June 2025, the exposed server contained a comprehensive test kit consisting of 59 different files. These were designed to probe other signed Windows binaries, seeking to replicate the hijack against new targets following the release of Windows 11 24H2, which rendered their previous attack path obsolete.

Scale and Reach of Operations

The exposed server also hosted an administrative panel called Simba Service, which provided granular data on the reach of these campaigns. The logs detail significant activity targeting users in Mexico, primarily through a typosquatted government website mimicking a national-ID lookup portal.

• 1,048 files were recovered from the exposed server, detailing the full development lifecycle of the phishing campaigns.
• 5.5 days of activity were recorded by the delivery panel between June 20 and June 26, 2026.
• 77,098 requests were processed by the delivery server during that window.
• 3,892 unique IP addresses from 101 countries interacted with the malicious infrastructure.
• 82.5% of the total traffic originated from Mexico, with the region accounting for 96.9% of all launch activity.
• 97.7% of launch events were tied to a single fraudulent lure file masquerading as a government PDF report.

Infrastructure and Execution Tactics

The attackers used a combination of sophisticated delivery methods, including Right-to-Left Override (RTLO) characters to disguise executable files as legitimate documents. Once executed, the loaders deployed infostealers capable of harvesting cryptocurrency wallets, browser credentials, and Telegram session data. A second, parallel campaign utilized a trojanized Ubisoft binary to drop a modular Remote Access Trojan (RAT).

the attacker used LLMs to operate more like a modern software product team.

— Rapid7, in their summary of the investigation

Implications for Security Teams

This incident demonstrates that the barrier to entry for high-scale, automated phishing is lowering as attackers integrate commodity AI tools into their pipelines. For defenders, the primary challenge is no longer just identifying individual malicious payloads but tracking the underlying techniques that AI allows attackers to iterate upon constantly. Organizations should prioritize monitoring for anomalous WebClient service activity, the spawning of binaries from WebDAV or UNC paths, and the presence of obfuscated file extensions. By focusing on these behavioral indicators, security teams can detect the delivery methods that remain effective even after specific vulnerabilities are patched.